How we handle
your information.

01Who we are

Second Wind is a done-for-you job search service operated by [registered company name], a company registered in England and Wales, company number [number], registered office [registered address]. In this notice, "we", "us" and "Second Wind" mean that company.

For the personal data described here we are the data controller. We are registered with the Information Commissioner's Office under registration [ICO registration number].

You can reach us at any time on hello@secondwind.careers.

02What we collect

What we hold depends on how far you get with us.

If you only use the free CV check

• Your email address, if you ask for the report.
• The CV text and job description you paste in, and the report we generate from it.

If you become a member

• Identity and contact: name, email, phone, location, and the dedicated job-search email address we use for applications.
• Career information: your CV, work history, education, qualifications, certifications, skills, portfolio or LinkedIn links, references where a form requires them.
• Search preferences: target roles, sectors, seniority, locations, remote or hybrid preference, salary expectations, notice period, and the guardrails you set about what you do not want applied to.
• Eligibility information: right-to-work status and visa or sponsorship requirements, because most applications ask.
• Application records: every role we matched, the score and reasoning, the tailored CV and cover letter, the date and time of submission, and any employer response.
• Account credentials for job boards and employer portals, where you choose to give them to us so we can apply on your behalf. See section 7.
• Billing information: handled by Stripe. We see the fact and status of your payments. We never see or store your full card number.
• Correspondence: emails, messages and call notes between you and us.

Special category data

We do not ask for it, and you should not send it to us unprompted. However, two things happen in a real job search that we have to be straight with you about:

• Many employers attach equality and diversity monitoring forms asking about ethnicity, religion, sexual orientation, disability or health. These are optional. Our default is to leave every one of them blank and select "prefer not to say" where that option exists. We will only complete them if you have given us specific written instructions to do so, and that instruction is your explicit consent under Article 9(2)(a) UK GDPR. You can withdraw it at any time.
• If you tell us about a health condition or disability so we can request reasonable adjustments at interview, we will use it only for that, only with your explicit consent, and only with the specific employer concerned.

Technical data

When you visit the website we process your IP address, browser type, device type, referring page and pages viewed. See our cookie policy.

03Why we use it, and our lawful basis

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights and concluded it is not. You can ask us for that assessment, and you can object at any time.

04Automated decision-making and AI

We use AI models as a tool inside a human process. Being precise about this matters, so:

• AI is used to score how well a role matches your experience, and to draft tailored CV and cover letter content from what is genuinely in your CV.
• A trained human specialist reviews every application before it is submitted. Nothing is sent to an employer without a person seeing it.
• We do not make decisions about you that produce legal or similarly significant effects on you based solely on automated processing. The decision to apply, skip or flag a role is made or confirmed by a person.
• Our models are instructed never to invent, inflate or imply experience, qualifications, tools, clearances or years you do not have. Everything we write must be defensible by you in an interview.

We do not control what employers do with your application after it arrives, including whether they run it through their own automated screening. If an employer makes a solely automated decision about you, your rights lie against them as controller.

05Who we share it with

We never sell your personal data and we never share it for third-party advertising.

Employers and job boards

This is the whole point of the service. When you instruct us to apply for a role, we send your CV, cover letter and application answers to that employer or their recruitment platform. Once it arrives, that employer is an independent controller of your data and their own privacy notice applies. We cannot delete an application after it has been submitted.

Our team

Application specialists, some of whom work for us as contractors outside the UK, access your data to do the work. Every one of them is under a written confidentiality and data protection agreement, works to a documented operations manual, and is given the minimum access needed.

Service providers acting as our processors

Others

We may disclose data to professional advisers, to a buyer if the business is sold, or to authorities where the law requires it.

5bEmployer-funded programmes, and business contacts

When an employer pays for someone's programme

Where an organisation funds job-search support for people leaving it, the relationship splits in two and it matters which is which.

• For the delivery of that programme we generally act as a processor on the employer's instructions, with our operators as sub-processors. The employer is the controller. We will sign their data processing agreement or provide ours.
• The participant's own consent is still required before we do anything. Participation is voluntary and can be withdrawn at any time.
• The employer receives aggregate reporting only. They never see an individual's applications, the roles they targeted, or who turned them down. We tell every participant this at the start, and we would rather lose an engagement than change it.

Business contact data — how we approach organisations

We contact HR leaders, employment solicitors and HR consultancies about our employer service. If that is why you are reading this:

• Lawful basis: legitimate interests — offering a relevant business service to someone whose professional role makes it relevant. We keep a written legitimate interests assessment and will share it on request.
• Where we get it: publicly available professional sources such as company websites, LinkedIn and Companies House. We do not buy contact lists.
• What we hold: name, job title, employer, work email and any correspondence. Nothing more.
• Marketing rules: corporate subscribers do not require prior consent under PECR. Sole traders and ordinary partnerships do, and we check Companies House rather than guessing from an email address. We screen against the TPS and CTPS before any call.
• Your rights: we identify ourselves in every message, offer an opt-out in every message, follow up once and then stop. Ask us to stop and we add you to a suppression list permanently — which means we keep your email address for the sole purpose of never contacting you again.
• Retention: 24 months from last contact, then deleted, unless you are on the suppression list.

06International transfers

Some of our providers and some of our specialists are outside the UK. Where personal data leaves the UK we rely on one of the following: a UK adequacy regulation for that country, or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. You can ask us for a copy of the safeguards in place.

07Your login credentials

• We set up a dedicated email address for your job search. Wherever possible we create portal accounts against that address rather than using your personal accounts.
• Credentials are held in an encrypted password manager, shared with the specific specialist working your account and no one else. They are never written into your tracker, into a spreadsheet, into email or into chat.
• We will never ask for your online banking, your personal primary email password, your government identity logins, or your national insurance, passport or bank details before you have a written offer in hand.
• You can revoke our access at any moment by changing the password. You do not need to tell us first.
• When you leave, credentials are destroyed within 30 days as part of offboarding.

If anyone contacts you claiming to be from Second Wind and asks for bank details or payment outside our Stripe checkout, it is not us. Forward it to hello@secondwind.careers.

08How long we keep it

09Your rights

Under UK GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Rectify anything inaccurate. If a CV we produced contains an error, tell us and we will correct it and, where we can, notify the employer.
• Erase your data. Note we cannot recall an application already sent to an employer.
• Restrict or object to our processing, including any processing based on legitimate interests.
• Portability of the data you gave us, in a machine-readable format.
• Withdraw consent at any time, where consent is the basis. This does not affect processing before you withdrew it.
• Not be subject to solely automated decisions with legal or similarly significant effects.

To exercise any of these, email hello@secondwind.careers. We will respond within one month. It is free unless a request is manifestly unfounded or excessive.

If you are unhappy with how we have handled your data, please tell us first so we can fix it. You also have the right to complain to the Information Commissioner's Office, ico.org.uk/make-a-complaint, or on 0303 123 1113.

10Security

We use access controls so that specialists only reach the accounts they are working on, encrypted storage for credentials, two-factor authentication on our own accounts, written confidentiality agreements with everyone who touches client data, and a documented operations manual that forbids putting sensitive details into trackers or chat.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the ICO within 72 hours and tell you without undue delay where the risk is high.

11Children

Second Wind is for working professionals. It is not directed at anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

12Changes to this notice

If we change this notice we will update the date at the top. If a change materially affects your rights, we will email members directly before it takes effect.